#! /bin/bash

###
 # @Author: Wanli
 # @Date: 2021-06-24 19:09:16
 # @LastEditTime: 2025-03-19 21:39:33
 # @LastEditors: Wanli
 # @Description: In User Settings Edit
 # @FilePath: xxx.sh
 # Date:2019-07-11
###


# Function:对账户的密码的一些加固
read -p "设置密码最多可多少天不修改：" A
read -p "设置密码修改之间最小的天数：" B
read -p "设置密码最短的长度：" C
read -p "设置密码失效前多少天通知用户：" D

sed -i '/^PASS_MAX_DAYS/c\PASS_MAX_DAYS '$A'' /etc/login.defssed -i '/^PASS_MIN_DAYS/c\PASS_MIN_DAYS '$B'' /etc/login.defs
sed -i '/^PASS_MIN_LEN/c\PASS_MIN_LEN '$C'' /etc/login.defssed -i '/^PASS_WARN_AGE/c\PASS_WARN_AGE '$D'' /etc/login.defs
echo "已对密码进行加固，新用户不得和旧密码相同，且新密码必须同时包含数字、小写字母，大写字母!!"
sed -i '/pam_pwquality.so/c\password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= difok=1 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1' /etc/pam.d/system-auth
echo "已对密码进行加固，如果输入错误密码超过3次，则锁定账户!!

"n=`cat /etc/pam.d/sshd | grep "auth required pam_tally2.so "|wc -l`if [ $n -eq 0 ];then
sed -i '/%PAM-1.0/a\auth required pam_tally2.so deny=3 unlock_time=150 even_deny_root root_unlock_time300' /etc/pam.d/sshdfi
echo "已设置禁止root用户远程登录!!"
sed -i '/PermitRootLogin/c\PermitRootLogin no' /etc/ssh/sshd_config
read -p "设置历史命令保存条数：" E
read -p "设置账户自动注销时间：" F
sed -i '/^HISTSIZE/c\HISTSIZE='$E'' /etc/profilesed -i '/^HISTSIZE/a\TMOUT='$F'' /etc/profile

echo "已设置只允许wheel组的用户可以使用su命令切换到root用户!"
sed -i '/pam_wheel.so use_uid/c\auth required pam_wheel.so use_uid ' /etc/pam.d/sun=`cat /etc/login.defs | grep SU_WHEEL_ONLY | wc -l`
if [ $n -eq 0 ];then
    echo SU_WHEEL_ONLY yes >> /etc/login.defsfi

echo "即将对系统中的账户进行检查...."
echo "系统中有登录权限的用户有："
awk -F: '($7=="/bin/bash"){print $1}' /etc/passwd
echo "********************************************"

echo "系统中UID=0的用户有："
awk -F: '($3=="0"){print $1}' /etc/passwd
echo "********************************************"
N=`awk -F: '($2==""){print $1}' /etc/shadow|wc -l`
echo "系统中空密码用户有：$N"
if [ $N -eq 0 ]; then
    echo "恭喜你，系统中无空密码用户!!"
    echo "********************************************"
else
    i=1
    while [ $N -gt 0 ]
    do
        None=`awk -F: '($2==""){print $1}' /etc/shadow|awk 'NR=='$i'{print}'`
        echo "------------------------"
        echo $None
        echo "必须为空用户设置密码!!"
        passwd $None let N--
    done
    M=`awk -F: '($2==""){print $1}' /etc/shadow|wc -l`
    if [ $M -eq 0 ];then
        echo "恭喜，系统中已经没有空密码用户了!"
    else
        echo "系统中还存在空密码用户：$M"
    fi
fi

echo "即将对系统中重要文件进行锁定，锁定后将无法添加删除用户和组"
read -p "警告：此脚本运行后将无法添加删除用户和组!!确定输入Y，取消输入N;Y/N："
icase $i in [Y,y])
chattr +i /etc/passwd
chattr +i /etc/shadow
chattr +i /etc/group
chattr +i /etc/gshadow
echo "锁定成功!";; [N,n])
chattr -i /etc/passwd
chattr -i /etc/shadow
chattr -i /etc/group
chattr -i /etc/gshadow
echo "取消锁定成功!!";; *)
echo "请输入Y/y or N/n"
esac